View full title
Enacts the NY privacy act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing and to allow consumers to obtain the names of all entities with whom their information is shared.
In one paragraph
New York's A 4947 (the "New York privacy act") would add General Business Law Article 42-A. For solely automated decisions that materially contribute to denials of lending, housing, insurance, health care or similar services, controllers would have to disclose the automation, offer an appeal with meaningful human review and run annual impact assessments by an external, independent auditor or researcher. Consumers would also get opt-in consent, access, correction and deletion rights. AG penalties up to $15,000 per violation; private suits. Most sections would take effect two years after enactment. Referred to committee February 10, 2025 and January 7, 2026; not passed by either chamber.
Plain-English summary, written with AI assistance. The official text controls.
What it means for business
None yet: the bill is pending. If enacted, covered businesses processing New Yorkers' personal data would need opt-in consent, data protection assessments and, for automated decisions, appeal and audit processes, backed by AG penalties and lawsuits.
Key provisions
- Applies to businesses meeting one of four thresholds, such as $25 million annual gross revenue or personal data of 100,000 consumers
- Consumer rights: opt-in consent, access, portability, correction and deletion within 45 days; controllers owe duties of loyalty and care and must complete data protection assessments
- Automated decision-making: for solely automated decisions contributing to denial of financial or lending services, housing, insurance, health care or basic necessities, controllers must disclose that the decision was made by a solely automated process and offer an appeal with meaningful human review; annual impact assessments (also covering education enrollment and employment) by an external, independent auditor or researcher
- Data brokers must register annually with the Attorney General ($100 fee); penalty $1,000 per day for non-registration
- Attorney General may seek civil penalties of not more than $15,000 per violation; consumers injured by violations of § 1202(2), (7) or (8) may sue for actual damages or $1,000, whichever is greater, with fees
- Sections 1200 and 1204 take effect immediately; sections 1201-1203 and 1205-1207 two years after becoming law; the private right of action three years after
Latest legislative action
Jan 7, 2026. referred to consumer affairs and protection
Sponsors (showing 5 of 27)
| Name | Role |
|---|---|
| BICHOTTE HERMELYN | Primary |
| COOK | Primary |
| Linda Rosenthal D | Primary |
| Monica P. Wallace | Primary |
| SIMOTAS | Primary |
Topics and industries
Related topics
Affected industries
This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error